Conference presentation of "Gaihre, Anil, Yan Luo, and Hang Liu. "Do bitcoin users really care about anonymity? an analysis of the bitcoin transaction graph." 2018 IEEE International Conference on Big Data (Big Data). IEEE, 2018."

1. Do Bitcoin Users Really Care About Anonymity?
- An Analysis of the Bitcoin Transaction Graph
Anil Gaihre
Yan Luo
Hang Liu
10/20/21
University of Massachusetts Lowell

2. Outline
ØIntroduction and Background
ØAnonymity Metrics
ØMacro Analysis
ØMicro Analysis
ØConclusions
10/20/21
2

3. Bitcoin
10/20/21
3
• Intent of Bitcoin: replacing banks!
• Technical guarantees:
– Distributed consensus
– Pseudo-anonymous

4. How Does Bitcoin Work?
10/20/21
4
Transaction
Aliceà Bob
Miners
Proof of work
Transaction Confirmed
Aliceà Bob
Alice
Bob
Ram à Hari
Alice à Bob
Transactions inside
block
…
Normally 6 blocks after transaction
Publicly available blockchain
…

5. Background and Related Work
But, do users really care about anonymity? Or to
what extent they care about it?
Works on Anonymity concern:-
Altcoins
E.g. DashCoin
Graph Analysis
Third Party Crawling
E.g. Bitcoin forums
Interacting with
merchants/users
Mixers
E.g. Bitcoin Blender
Anonymous
Not
Anonymous
10/20/21
5
References:
1. Tim Ruffing, et al. Coinshuffle: Practical decentralized coin mixing
for bitcoin. In European Symposium on Research in Computer
Security, pages 345–364. Springer, 2014.
2. Gregory Maxwell. Coinjoin: Bitcoin privacy for the real
world,2013. Available at https://bitcointalk.org/?topic=279249.
3. DashCoin, Anonymous peer-to-peer Internet currency. Available
at http://dashcoin.info/
Trustless Coinjoin
E.g. Coinshuffle
References:
1. Malte Moser, et al. An inquiry into money laundering tools in the
bitcoin ecosystem. In eCrime Researchers Summit (eCRS), 2013,
pages 1–14. IEEE, 2013
2. Michael Fleder, et al. Bitcoin transaction graph analysis. arXiv
reprint arXiv:1502.01657, 2015
3. Sarah Meiklejohn, et al. A fistful of bitcoins: characterizing
payments among men with no names. In Proceedings of the
2013 conference on Internet measurement conference, pages
127–140. ACM, 2013

6. Contributions
• Anonymity Metrics
– Direct metric: hide their real-world identity?
– Indirect metric: hide their intention?
• Macro view analysis of anonymity concern of users
– The collective anonymity concerns from all users
• Micro view analysis of critical addresses
– Addresses from big organizations: Hot and cold wallet addresses.
– Bitcoin “believers”: Stock buyer addresses
– Addresses from backbone participants: Miners addresses
• BIGDATA: ~10 years of transaction data (~230 GB)!
10/20/21
6

7. Bitcoin Transaction Graph Looks Like
Transaction
Alice à Bob M
Address Transaction Mining Transaction
10/20/21
7
M

8. Constructing Bitcoin Transaction Graph
Rusty Block
Parser
CSV Dumps
Bipartite
Graph
Generator
Edge Lists(BTC,
timestamps)
Graph Project
Start
Graph in correct
format
Blockchain
Raw Data
Bitcoin Core
(v0.16.0)
10/20/21
8
Graph
Analysis
Anonymity concern insights!
References:
• Bitcoin Core Software. Available at https://bitcoin.org/en/bitcoin-core/
• Rusty blockparser github repository. Available at https://github.com/gcarq/rusty-
blockparser

9. Outline
ØIntroduction and Background
ØAnonymity Metrics
ØMacro Analysis
ØMicro Analysis
ØConclusions
10/20/21
9

10. Anonymity Metrics: How to Detect Anonymity
Concern?
Metric 1 (Address Reusing Frequency). Reusing an address = low concern on anonymity.
• AddressReuse. Available at https://en.bitcoin.it/wiki/Address reuse
• Satoshi Nakamoto. Bitcoin: A peer-to-peer electronic cash system. 2008
Metric 2 (Zero Balance). Addresses turned into zero balance = concern about anonymity.
Metric 3 (Address Intention). Hiding intention = cares about anonymity.
• Important because identifying the intentions of the addresses helps grouping
them together into some category to speed up the deanonymization process
10/20/21
10

11. Outline
ØIntroduction and Background
ØAnonymity Metrics
ØMacro Analysis
ØMicro Analysis
ØConclusions
10/20/21
11

12. Causes of Diameter Dynamics
Diameter: The maximum shortest path
between any 2 vertices in graph.
12
A1 A2 A3
T1 T2
T3 A4
A1 A2 A3
T1 T2
T3
A4
• New addresses: Diameter remains unchanged or increases
• No new addresses: Diameter remains unchanged or decreases
A1 A2 A3
T1 T2
T3
A1 A2 A3
T1 T2
T3
10/20/21
Unchanged Unchanged
Increased Decreased

13. 0
1000
2000
3000
4000
5000
6000
7000
2009-03-13
2009-05-21
2009-07-28
2009-10-05
2009-12-13
2010-02-20
2010-04-30
2010-07-07
2010-09-14
2010-11-22
2011-01-30
2011-04-09
2011-06-16
2011-08-24
2011-11-01
2012-01-09
2012-03-18
2012-05-25
2012-08-02
2012-10-10
2012-12-18
2013-02-25
2013-05-04
2013-07-12
2013-09-19
2013-11-27
2014-02-04
2014-04-13
2014-06-21
2014-08-29
2014-11-06
2015-01-14
2015-03-23
2015-05-31
2015-08-08
2015-10-16
2015-12-24
2016-03-01
2016-05-09
2016-07-17
2016-09-24
2016-12-01
2017-02-08
2017-04-18
2017-06-26
2017-09-03
2017-11-10
2018-01-18
2018-03-28
2018-06-05
Diameter
Macro View Analysis of Anonymity Concerns
Diameter : Main connected
component with majority of vertices
10/20/21
13
Majority: anonymity
concern users
Majority:
unconcerned users
Connected
components remain
separated
Remain consistent
New address
attaching on tail

14. • Exception: establishment of Bitcoin exchange centers + price hike probably caused
• New users joining Bitcoin à the increase of new address usage.
New Address vs Old Address to Receive Bitcoin
10/20/21
14
0
1000
2000
3000
4000
5000
6000
7000
0
5
10
15
20
25
30
35
40
2009-03-13
2009-05-21
2009-07-28
2009-10-05
2009-12-13
2010-02-20
2010-04-30
2010-07-07
2010-09-14
2010-11-22
2011-01-30
2011-04-09
2011-06-16
2011-08-24
2011-11-01
2012-01-09
2012-03-18
2012-05-25
2012-08-02
2012-10-10
2012-12-18
2013-02-25
2013-05-04
2013-07-12
2013-09-19
2013-11-27
2014-02-04
2014-04-13
2014-06-21
2014-08-29
2014-11-06
2015-01-14
2015-03-23
2015-05-31
2015-08-08
2015-10-16
2015-12-24
2016-03-01
2016-05-09
2016-07-17
2016-09-24
2016-12-02
2017-02-08
2017-04-18
2017-06-26
2017-09-03
2017-11-10
2018-01-18
2018-03-28
2018-06-05
#Addresses
(Millions)
Diameter
New Addresses used to receive Bitcoin
Old address used to receive Bitcoin
Diameter
• On average, old addresses: 55.25% vs new addresses: 44.75% to receive Bitcoin

15. 0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
2009-03-13
2009-05-21
2009-07-28
2009-10-05
2009-12-13
2010-02-20
2010-04-30
2010-07-07
2010-09-14
2010-11-22
2011-01-30
2011-04-09
2011-06-16
2011-08-24
2011-11-01
2012-01-09
2012-03-18
2012-05-25
2012-08-02
2012-10-10
2012-12-18
2013-02-25
2013-05-04
2013-07-12
2013-09-19
2013-11-27
2014-02-04
2014-04-13
2014-06-21
2014-08-29
2014-11-06
2015-01-14
2015-03-23
2015-05-31
2015-08-08
2015-10-16
2015-12-24
2016-03-01
2016-05-09
2016-07-17
2016-09-24
2016-12-01
2017-02-08
2017-04-18
2017-06-26
2017-09-03
2017-11-10
2018-01-18
2018-03-28
2018-06-05
Percentage
Rich Addresses Poor Addresses
Rich Vs Poor Addresses
Rich addresses are more concerned about anonymity.
10/20/21
16
Events of hacking and stealing
Rich Addresses: Top 25% rich Bitcoin addresses.
Poor Addresses: Remaining non-zero Bitcoin addresses.
References:
• Timithy B. Lee. A brief history of Bitcoin hacks and frauds. Available at https://arstechnica.com/tech-
policy/2017/12/a-brief-history-of-bitcoin-hacks-and-frauds/

16. Outline
ØIntroduction and Background
ØAnonymity Metrics
ØMacro Analysis
ØMicro Analysis
ØConclusions
10/20/21
17

17. • More insights: stock addresses are immediately influenced by the exchange rate
of Bitcoin.
Stock Buyer Addresses
• Stock buyer address features: only receive the Bitcoin but never spent
• Out-degree = 0.
• This is how we reveal their intentions.
10/20/21
18
0.1
1
10
100
1000
10000
100000
1
10
100
1000
10000
100000
1000000
10000000
2/22/08 7/6/09 11/18/10 4/1/12 8/14/13 12/27/14 5/10/16 9/22/17 2/4/19
#Stock
address
Stock address
Bitcoin price
Bitcoin
price
(USD)

18. 50 BTC
50 BTC
M1
M2
M3 3
2
1
6 7
CASE I
• Miner accumulates the
mined Bitcoins
• Low Anonymity
concern
4
8
5
9
10 11
2010-06-04 to 2010-06-15
150 BTC
50 BTC
Address with
BTC
M
Addresses
Transaction
Mining
Transaction
M1 1 2 3 4 5 6 7 9 10
11 13
12
14
17
16
15
18
19
20
21
23
22
24
25
27
26
8
17.97607515 BTC
16.00036303 BTC
16.00036719 BTC
2017-11-19 à
2010-02-21 2011-06-14
2018-01-05
50 BTC
CASE II
Miner splits the mined Bitcoins, when Bitcoin price rises.
Change in anonymity concern
Miners: Before and After Bitcoin Price Hike (2 real cases)
19 10/20/21

19. Hot and Cold Wallets of Big Organizations
10/20/21
20
Hot Wallet Cold Wallet
Connected to the internet Offline (hard disk or paper)
Convenient to use but
vulnerable to hacking
More secured but not
convenient to use

20. Tag Address ID
Total inflow from
other addresses
Bitcoin
balance
Degree
Deepbit 1VayNert3x1KzbpzMGt2qdqrAThiRovi8 25467352.64 0.2 1565611
SatoshiDICE Hot Wallet 18uvwkMJsg9cxFEd1QDFgQpoeXWmmSnqSs 399678.8714 0.00053 414842
SatoshiDICE Hot Wallet 1MSzmVTBaaSpKDARK3VGvP8v7aCtwZ9zbw 386456.4036 0.00033 414270
SatoshiDICE Hot Wallet 1PeohaRGaTF8cSzDqP1yYfzDah66xiriEQ 384443.0361 0.00079806 413407
SatoshiDICE Hot Wallet 1Bd5wrFxHYRkk4UCFttcPNMYzqJnQKfXUE 383879.8434 0.05339999 415362
SatoshiDICE Hot Wallet 15fXdTyFL1p53qQ8NkrjBqPUbPWvWmZ3G9 383444.5918 0.00028 415042
FoxBit Hot Wallet 1FoxBitjXcBeZUS4eDzPZ7b124q3N7QJK7 156329.1069 0.04314468 560202
Unknown 13vHWR3iLsHeYwT42RnuKYNBoVPrKKZgRv 17600542.04 0.00306531 1011905
Unknown 19iVyH1qUxgywY8LJSbpV4VavjZmyuEyxV 9326468.877 0.00000651 430643
Hot Wallet Addresses of Big Organizations
• Hot wallet addresses of big organizations:
– Private key is online for convenience
– Has relatively high degree, with low accumulations of Bitcoin but higher flow through them.
– Feature: Degree >= 50,000, flow >= 150,000 BTC , Accumulated BTC <=10 BTC
10/20/21
21
We can help uncover hidden (similar) hot wallets!

21. Outline
ØIntroduction and Background
ØAnonymity Metrics
ØMacro Analysis
ØMicro Analysis
ØConclusions
10/20/21
22

22. Conclusions
• Majority of the users don't care about the anonymity
• Most of the addresses that are concerned about anonymity
are rich addresses
• Users start concerning about anonymity when the price of
Bitcoin goes high
– Seen with a real examples of miners
– Rich addresses concerning more when price hiked, and hacking events
started
• Stock addresses don’t hide their intent of making profits on
Bitcoin price hike.
• With design of some filters, one can find the hot wallet
addresses and cold wallet addresses of big organizations (like
exchange centers, gambling sites, miners etc.)
10/20/21
23

23. Thank You & Questions?
Opensource at: https://github.com/Anil-Gaihre/Bitcoin_AnonymityConcern
Contacts: agaihre@stevens.edu
10/20/21